ScorpTech x402 API

X509 Decode

x509_decode

Read-onlyIdempotent

Decode PEM/DER X.509 certificates, chains and CSRs offline: subject/issuer DN, serial, validity and days left, SANs, key type/size/curve, signature algorithm, key usage / EKU / basic constraints, AKI/SKI, OCSP / CA-issuer / CRL URLs, policies and embedded SCT count, SHA-1/SHA-256 fingerprints and SPKI pin; verifies each chain link signature and order, flags self-signed, expired / expiring, weak keys, SHA-1 signatures and over-long lifetimes, and checks hostname coverage (RFC 6125 wildcards). Private keys are refused. Price: $0.003 USDC per successful call (x402, Solana). Same tool over HTTPS: POST https://scorptech.it.com/api/x402/v1/x509-decode

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "pem": "<pem>"
    },
    "name": "x509_decode"
  }
}

Input Schema

Name	Required	Description	Default
`pem`	Yes	One or more PEM certificates (leaf first) and/or a CSR, or base64 DER
`hostname`	No	Optional hostname / IP to check against the leaf SANs

Schema Changelog

Changes observed during successful MCP inspections.

AddedOct 23, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only/idempotent/non-destructive, but the description adds substantial behavior: offline processing, refusal of private keys, chain-link signature/order verification, and specific flags for expiry, weak keys, SHA-1 signatures, and over-long lifetimes. No contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and packs relevant details into a dense list; the payment note is useful but the run-on semicolon list reduces readability slightly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex certificate decoder with no output schema, the description supplies enough about inputs, decoded fields, verification behavior, and refusal rules to call it correctly. Annotations cover the safety profile, so no important context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3; the description still adds meaning for the hostname parameter by specifying RFC 6125 wildcard coverage and leaf-SAN checking, and clarifies accepted PEM/DER/chains/CSR inputs. It does not add syntax beyond the schema, but the extra semantics are useful.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first clause states a specific verb (Decode) and resource (PEM/DER X.509 certificates, chains and CSRs) with offline scope, and the rest enumerates the exact fields and checks. This is far beyond tautology and clearly distinguishes it from generic certificate-fetching tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context: use it for offline decoding of certificate chains/CSRs and optional hostname coverage, and private keys are explicitly refused. It does not name a sibling alternative such as ssl_cert_info, so it stops short of explicit routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ScorpTech x402 API tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?